It could just be the hacker came to ithemes' office and copied the password text file into a usb drive. Easy peasy hacking! :D